6 ms·

It's very common for internal hostnames to be resolvable only internally (such as with split-zone or dedicated internal DNS servers). Edit: Or do you mean as p

It's very common for internal hostnames to be resolvable only internally (such as with split-zone or dedicated internal DNS servers). Edit: Or do you mean as part of the challenge-response mechanism? Yeah, that would have to be public.

zeeZ 8y ago
Only needs to be public for the challenge though. We use split DNS with an external server that has an empty zone. Internal clients are limited to setting their respective _acme-challenge.subdomain TXT record and delete it afterwards.
- someone13 8y ago
  Out of curiosity, how is this implemented?
  - w7 8y ago
    Not the person you asked, but: Besides possibly being a function of a provider's API; DNS server security policies can be used to limit updates to certain domains and/or record types based on preshared key. Since the DNS-01 challenge only needs to make a TXT record with a predetermined name you can configure a zone like so (using BIND syntax as an example): key "example-key" { algorithm hmac-sha512; secret <KEY_HERE>; }; zone { ... update-policy { grant "example-key" name _acme-challenge.example.com TXT; }; }; another option is to have a CNAME from _acme-challenge.example.com to a dedicated challenge zone like challenges.example.com that has similar restrictions. This coupled with something like acme.sh makes it easy and relatively secure for machines to generate their own certificates.
isostatic 8y ago
It is common, but as dns over https becomes standard it won’t be able to be.
- organsnyder 8y ago
  Why would that preclude the ability to host certain zones only on internal DNS servers?
  - yjftsjthsd-h 8y ago
    It appears that some clients just universally query third-party servers, thereby giving out a list of every host name that they're looking for to a third party.
    - organsnyder 8y ago
      Not enterprise devices, though. Some enterprise networks even block third-party DNS servers (yes, even over HTTPS—all traffic must go through the corporate proxy).
  - isostatic 8y ago
    If the default option allows a fallback then yes, only split dns (where you get different results internal and externally) will be affected. However how long before the default option is via https only.
    - organsnyder 8y ago
      I still don't understand. How does DNS over HTTPS differ from DNS over port 53 in a way that would impact the ability to host internal zones (or even split DNS)?

zeeZ 8y ago

Only needs to be public for the challenge though. We use split DNS with an external server that has an empty zone. Internal clients are limited to setting their respective _acme-challenge.subdomain TXT record and delete it afterwards.

someone13 8y ago
Out of curiosity, how is this implemented?
- w7 8y ago
  Not the person you asked, but: Besides possibly being a function of a provider's API; DNS server security policies can be used to limit updates to certain domains and/or record types based on preshared key. Since the DNS-01 challenge only needs to make a TXT record with a predetermined name you can configure a zone like so (using BIND syntax as an example): key "example-key" { algorithm hmac-sha512; secret <KEY_HERE>; }; zone { ... update-policy { grant "example-key" name _acme-challenge.example.com TXT; }; }; another option is to have a CNAME from _acme-challenge.example.com to a dedicated challenge zone like challenges.example.com that has similar restrictions. This coupled with something like acme.sh makes it easy and relatively secure for machines to generate their own certificates.

isostatic 8y ago

It is common, but as dns over https becomes standard it won’t be able to be.

organsnyder 8y ago
Why would that preclude the ability to host certain zones only on internal DNS servers?
- yjftsjthsd-h 8y ago
  It appears that some clients just universally query third-party servers, thereby giving out a list of every host name that they're looking for to a third party.
  - organsnyder 8y ago
    Not enterprise devices, though. Some enterprise networks even block third-party DNS servers (yes, even over HTTPS—all traffic must go through the corporate proxy).
- isostatic 8y ago
  If the default option allows a fallback then yes, only split dns (where you get different results internal and externally) will be affected. However how long before the default option is via https only.
  - organsnyder 8y ago
    I still don't understand. How does DNS over HTTPS differ from DNS over port 53 in a way that would impact the ability to host internal zones (or even split DNS)?